From 8863ab950300de065dab97895cf8a990e6f08039 Mon Sep 17 00:00:00 2001
From: Matthijs Mekking <matthijs@isc.org>
Date: Tue, 9 May 2023 15:02:54 +0200
Subject: [PATCH] Set default max-zone-ttl to "unlimited"

Now that the keymgr tracks the maximum TTL used in a zone, we no longer
need an artifical value when calculating key rollover timings. The
max-zone-ttl value can be set to 0 (unlimited) by default.

This means that the built-in "default" and "insecure" can now be used
on zones that have TTL values higher than 1 day (and no longer fail
to load the zone).

You can still set the max-zone-ttl value to ensure that the loaded
zone does not have a too high TTL (causing the zone fail to load, and
to limit the TTL on incoming updates).
---
 doc/misc/options           | 2 +-
 lib/dns/include/dns/kasp.h | 2 +-
 lib/isccfg/namedconf.c     | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/doc/misc/options b/doc/misc/options
index dd33c52f14..f2e1adf54b 100644
--- a/doc/misc/options
+++ b/doc/misc/options
@@ -15,7 +15,7 @@ dnssec-policy <string> {
 	cds-digest-types { <string>; ... };
 	dnskey-ttl <duration>;
 	keys { ( csk | ksk | zsk ) [ ( key-directory ) ] lifetime <duration_or_unlimited> algorithm <string> [ <integer> ]; ... };
-	max-zone-ttl <duration>;
+	max-zone-ttl ( unlimited | <duration> );
 	nsec3param [ iterations <integer> ] [ optout <boolean> ] [ salt-length <integer> ];
 	parent-ds-ttl <duration>;
 	parent-propagation-delay <duration>;
diff --git a/lib/dns/include/dns/kasp.h b/lib/dns/include/dns/kasp.h
index 347e3ff746..20886f984c 100644
--- a/lib/dns/include/dns/kasp.h
+++ b/lib/dns/include/dns/kasp.h
@@ -121,7 +121,7 @@ struct dns_kasp {
 #define DNS_KASP_PUBLISH_SAFETY	     "3600"
 #define DNS_KASP_PURGE_KEYS	     "P90D"
 #define DNS_KASP_RETIRE_SAFETY	     "3600"
-#define DNS_KASP_ZONE_MAXTTL	     "86400"
+#define DNS_KASP_ZONE_MAXTTL	     "0"
 #define DNS_KASP_ZONE_PROPDELAY	     "300"
 #define DNS_KASP_PARENT_PROPDELAY    "3600"
 
diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
index 3d3153e374..566497e1a1 100644
--- a/lib/isccfg/namedconf.c
+++ b/lib/isccfg/namedconf.c
@@ -2209,7 +2209,7 @@ static cfg_clausedef_t dnssecpolicy_clauses[] = {
 	{ "cds-digest-types", &cfg_type_algorithmlist, 0 },
 	{ "dnskey-ttl", &cfg_type_duration, 0 },
 	{ "keys", &cfg_type_kaspkeys, 0 },
-	{ "max-zone-ttl", &cfg_type_duration, 0 },
+	{ "max-zone-ttl", &cfg_type_maxduration, 0 },
 	{ "nsec3param", &cfg_type_nsec3, 0 },
 	{ "parent-ds-ttl", &cfg_type_duration, 0 },
 	{ "parent-propagation-delay", &cfg_type_duration, 0 },